GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
The complainant sought injunctive relief against a search engine operator because the search engine’s list of results for searches of her name contained a link to the transcript of a TV broadcast that was uploaded to an online archive in 2010. In the document the complainant is identified by name and accused of unfair treatment of an employee. The Celle Higher Regional Court rejected her claim and then she referred to the Federal Constitutional Court. The Court decided for the first time that where EU fundamental rights take precedence over German fundamental rights, the Court itself can directly review, on the basis of EU fundamental rights, the application of EU law by German authorities. What is decisive here is that under current EU law there would otherwise be a gap in protection regarding the application of EU fundamental rights by the ordinary courts. The fundamental rights of both the Basic Law and the Charter are not limited to protecting citizens vis-à-vis the state, but also afford protection in disputes under private law. The conflicting fundamental rights must be balanced on an equal basis.https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/EN/2019/bvg19-084.html According to the Court, the balancing exercise here must take into account the fundamental right to private and family life as well as the fundamental right to the protection of personal data on the one hand and the freedom to conduct a business on the other hand. The fundamental rights of third parties directly affected must also be considered, including the freedom of expression of the broadcasting corporation and the internet users’ interest in receiving information. The search engine operator’s economic interests as such are in principle not sufficiently weighty to justify a limitation of the affected person’s right to protection. It is not for the individual to determine unilaterally what information may be disseminated about them in the course of public communicatio
In 1982, the complainant was convicted of murder. The magazine DER SPIEGEL published three articles identifying the complainant by name. Later, it uploaded the articles to the magazine’s online archive where they were freely available to everyone. When the complainant’s name is entered in any search engine, these articles are listed among the top search results. In 2009, the complainant asked the magazine to remove the articles, and following the latter’s rejection he referred to the German Supreme Court (Bundesgerichtshof - BGH). The Court rejected the action on the grounds that the public interest and the magazine’s right to freedom of expression outweigh the complainant’s interest in protection of his personality. The complainant then referred to the German Constitutional Court raising the issue of the protection of fundamental rights between private actors. The German Constitutional Court decided that the fundamental rights of the Basic Law (Grundgesetz - GG) constitute the ground in this legal dispute, which falls within the field of application of EU law. However, the dissemination of press articles is covered by the media privilege, for which EU law grants Member States leeway to regulate. Therefore, the matter at stake is not determined by EU law in its entirety. The conflicting fundamental rights must be balanced against one another and the internet communication should be taken into consideration. The Court ruled that the general right of personality “does not encompass a right to request that all information relating to one’s person that is disseminated through communication processes be deleted from the Internet. [...] The balancing must consider the guarantees of freedom of expression and freedom of the press, which are restricted by limiting media reporting to anonymised information. The Court determined three criteria to be considered for the balancing test: * The lawfulness of the initial publication; * The extent to which the time passed sinc
Several NGOs brought a complaint before the Conseil d’Etat to stop a new form of cooperation between two national services (SIAO and OFII) in charge of asylum seekers and beneficiaries of international protection. This new form of cooperation leads to a new joint database and, thus, to a new processing operation of the applications for asylum by the SIAO and the OFII. This new database includes the personal data of the asylum seekers. The Conseil d’Etat had to assess when the Data Protection Impact Assessments (DPIA) according to Article 35 GDPR should be carried out in this case. The Conseil d’Etat stated that the DPIA must be carried out prior to the processing operation, but it must also be updated after the actual launch of the processing operation to ensure that the risks to the rights and freedoms of the natural persons whose personal data are processed are always duly taken into account. If further found that carrying out the DPIA when initiating the processing operation was sufficient to comply with Article 35 GDPR.
The complainant asked his bank (ING Bank N.V.) to remove his data from the BKR registration (office for credit) under Article 21 GDPR. The bank did not answer to the request. The data subject brought a complaint before the Court of First Instance. The Court of First Instance found the complaint inadmissible and the complainant appealed the decision. The Amsterdam Court of Appeal considered that a request under Article 21 GDPR can be made at any time and several times. It also found that a provisional measure can be granted under Article 21 GDPR if an urgent action is needed. However, in the present case, the Court stated that the applicant did not prove the urgent interest for the interim measures. Thus, the measures could not be granted and the dedicated claim was rejected as inadmissible. The Court found that the applicant should have submitted a new request under Article 21 GDPR.
The Dutch Employee Insurance Agency (UWV) fined an employer for the late reporting of an employee's sick leave with a no-risk insurance policy. According to Article 38b of the Sickness Benefits Act, an employee can ask an employer about a no-risk policy two months after the beginning of the employment. The employee at stake had been employed for more than three years and he had had enough time to ask about the no-risk policy. The employee claimed that asking about the no-risk policy was in conflict with the data protection rules under the GDPR because it is essentially ‘data concerning health’. The Court found that Article 38b of the Sickness Benefits Act is not in conflict with the GDPR. Whether or not a no-risk policy applies is not relevant and there is no question on ‘data concerning health'. Moreover, processing under the GDPR would be permitted in this case even if there was health data and the exception of Article 9(2) GDPR would apply. The agency was therefore allowed to impose a fine on the employer.
DFW (a Dutch movie distributor) applies a protocol to its processing of personal data which was approved by the Dutch DPA before the GDPR came into force. DFW asked Ziggo (an internet service provider) to provide IP addresses of customers who according to DFW shared movies illegally. Ziggo refused to provide this information. Τhe Court had to assess whose interests prevail in this case: DFW's interest in the protection of its intellectual property rights or Ziggo's interest in the protection of the personal data of its customers. The Court found that any processing needed to be based on legitimate interests according to Article 6(1)(f) GDPR and that Ziggo had to comply with Article 6(4)(d) GDPR. The Court found that DFW had a legitimate interest and that the processing was necessary. However, the Court pursued a balancing exercise between the interests of DFW and the interests of the data subjects and found that the approved protocol was not transparent enough. Thus, the possible consequences for the data subjects of providing their data to DFW could not be estimated. DFW failed to make clear which action it would take, under which circumstances and in which manner it would inform the data subjects of their rights. The Court is of the opinion that the interests of Ziggo's customers are still insufficiently safeguarded, and it, therefore, rejected DFW’s claims confirming the ruling of the Court of First Instance. The Court based its ruling on the national civil code, Articles 4(2) and 6 GDPR, Articles 17 and 47 of the Charter of Fundamental Rights (CFR), and Articles 8 and 13 ECHR.
SIN-NL is a foundation that works to improve the position of victims of medical errors or their survivors and the patient safety and quality of healthcare. SIN-NL publishes online a blacklist of doctors and a blacklist of judges, which contain names of doctors, judges and other persons and organisations within the healthcare sector who according to SIN-NL act unlawfully. The plaintiff was a public prosecutor, that acted in cases of medical malpractice. The plaintiff's name and photo were included in an article in the list of the doctors and specific accusations against here were made. The name of the plaintiff's name and job were also mentioned there. The Public Prosecutor's Office claimed that the inclusion of the names and the photo violated the GDPR and the plaintiff's portrait right, hence they should be removed. The Court had to balance the interests of the opposing parties. The Court found that the allegations against the plaintiff were inaccurate. Moreover, the photo was published without the plaintiff's consent and thus it violated her portrait right. The paintiff also saw a violation of Articles 33, 35 and 36 of the GDPR, which the defendant has not contested. The Court found that the publication of the blacklists violated Dutch law and ordered the removal of the article at stake. It also ordered the defendants to submit a request for removal to Google.
The Hamburg Police created a reference database containing biometric data (facial recognition templates) to identify suspects in crimes related to the G20 summit in July 2017. The Hamburg police set up the "Black Block" special commission and decided to compile an extensive image file. This consists of images created by the police itself, video surveillance recordings of certain S-Bahn (train) stations, other relevant recordings available on the Internet and of privately created image files. The police came into possession of these files after calling on the public to upload relevant image files to a portal of the Federal Criminal Police Office (BKA). The resulting collection, which comprises around 32,000 image files (the "basic file"), consists of (video) recordings of people at meetings related to the G20 summit, in the run-up to and around such meetings, and during the commission of criminal offenses. The police obtained the disputed reference database from the basic file using specially acquired facial recognition software ("GAS"). It consists of digital extracts of the faces identified by the software in the images of the basic file ("templates"). Based on a measurement of the individual distances between eyes, ears, nose and mouth by the GAS, the templates are intended to enable the automated (re)recognition of individual physiognomies with a high degree of probability. In a letter dated July 5, 2018, the Hamburg DPA informed the police of their opinion that the biometric analysis of the faces of thousands of uninvolved people represented a significant infringement of fundamental rights. In a letter dated July 18, 2018, the Attorney General's Office asserted to the Hamburg DPA that the public prosecutor's office had sole authority to manage the use of the reference database. Attached to the letter was a legal opinion stating that the creation and use of the reference database was legally unobjectionable. In a letter dated July 23, 2018, the police explained
The appealed decision concerns a healthcare professional (data subject) whose appointment as a deputy member of PGC Limburg (Provinciale Geneeskundige Commissie van Limburg) was withdrawn by a decision correcting his previous appointment. The data subject submitted an access request at the FPS Public Health (controller) to figure out why his appointment was withdrawn. With no response from the FPS Public Health, he filed a first complaint with the Belgian DPA. In October 2018, the DPA ordered the FPS Public Health to respond to the data subject's request, but the FPS did not comply. The data subject then filed a second complaint in 2019. The DPA found that the FPS had not established internal procedures in compliance with the GDPR's standards. In doing so, the FPS Public Health also failed to comply with the principle of accountability (Article 5(2) GDPR). The DPA noted that the FPS acknowledged these facts and stated that there were problems with its internal procedures. The DPA decided to reprimand the FPS for its violations. Additionally, the DPA held that the FPS must implement internal procedures in line with the GPDR. In the appeal procedure, the FPS argues that: 1. the complaint has become devoid of all purpose 2. the DPA interprets the right to access to broad, violating Article 15 GDPR; 3. there was no violation of Article 12(3) and 12(4) GDPR, as it has a procedure in place to handle these requests; and 4. the DPA exceeded the limits of its competence, as the decision was based on violations that were not stated by the data subject. The Court of Appeal of Brussels held that, while the purpose of the complaint deviates from that of the appealed decision, the DPA can, on its own initiative, investigate the controller after a complaint. The Court found no trace of the FPS's alleged statement that it commited any kind of error in the record of the proceedings. However this was indicated by the DPA and, moreover, used to substantiate its decision. The Co
The plaintiff was designated as insolvency administrator for the B. GmbH (a limited liability company), that was not able to communicate its financial records after the opening of the insolvency procedure. Needing those records for the procedure, the plaintiff requested that the tax office of Gießen provide him with the documents. He based his demand, amongst other grounds, on §80 of the Hessian data protection law (freedom of information) and the the right of access (Article 15 GDPR) of the debtor on its behalf. This was possible as the applicable German law expands the right to access to legal entities in this specific case. The tax office refused, arguing that the plaintiff could not be considered as the data subject concerned but only as a “third party” as defined in Article 4(10) GDPR. Can an insolvency administrator exercise the right to access on behalf of a company? The Administrative Court of Gießen ruled in favor of the tax office. The Court started by demonstrating that the debtor, a corporation, had indeed a right of access under Article 15 GDPR in all taxation matters despite not being a natural person, in accordance with §2a(5) of the Abgabenordnung (national tax law). The Court then agreed with the tax office that the plaintiff is a “third party” and pointed out that the right of access is a highly personal right which could neither be alienated nor transferred, not even in the event of the opening of an insolvency procedure. Thus, the insolvency administrator had no rightful claim against the tax office for the release of financial records of the debtor.
The applicant requested the Court to remove his credit registration from two bank databases, Achmea and ABN AMRO, because these registrations prevented him from obtaining loans and leases. The claimant based his application on Article 8 of the ECHR and Article 7 of the Charter. In their defence, the banks argued that the processing of the personal data was not based on the data subject’s consent under Article 6(1)(a) GDPR but on compliance with legal obligations under Article 6(1)(c) GDPR and that the data subject did not have the right to object to the processing. The Court had to balance the different interests at stake to assess whether the banks' refusal to erase the personal data was legitimate. First of all, the Court described that the objective of credit registration was to protect consumers against excessive lending and to protect providers of credit against borrowers who have not proven their ability to repay the loans. Then, the Court found that the credit registration system necessarily involves the processing of personal data, protected by Article 16(2) TFEU. It found that personal data can be collected only for specific purposes listed exhaustively under Article 6(1) GDPR. In addition, the Court stressed the difference between the right to object to processing on the one hand, which applies where the processing is based on Article 6(1)(e) GDPR or Article 6(1)(f) GDPR, and the right to erasure on the other hand, which applies even if the processing is based on Article 6(1)(c) GDPR. The Court confirmed that in this case the processing was based on Article 6(1)(c) GDPR and that the claimant could ask for the erasure of his personal data. However, the controllers could still refuse the erasure on the basis of compelling legitimate grounds which would outweigh the interests, rights and freedoms of the data subject. It found that only the “negative” credit registrations prevented the Claimant from obtaining loans and leases but that they were necessar
In July 2018 the CNIL adopted a decision clarifying the new rules on consent for targeted advertisement under GDPR. It initiated a consultation process for the first quarter of 2020 to define the practical arrangements for obtaining consent. It determined a six-month adaptation period. Two associations requested to annul the decision of CNIL on grounds of excess of power and to instruct it to publish both on its website and on the pages of its press releases of 28 June and 18 July, a reference to the decision of the Conseil d'Etat which should indicate that "continued navigation" does not constitute a valid means of expressing consent for cookies and online tracking devices, while every day of delay would imply a penalty of 500 euros. The Council has to assess whether the CNIL had the power to initiate such a process. The Council found that the CNIL is an independent administrative authority with wide discretion in the exercise of its missions. In this sense, the CNIL can initiate such an action plan in order to achieve more effective compliance with the data protection law. The Council ruled that the six-month period of tolerance which the CNIL provided the stakeholders in order to fully comply with the rules is legal. Finally, the CNIL’s decision does not prevent the Commission from carrying out controls during the mentioned period and imposing sanctions for serious breaches of the new data protection framework.
Client Y of Bank X requested the bank on the basis of Article 16 GDPR to write their name with the appropriate diacritics. The Bank argued that this was not possible with their current computer systems and could thus not fulfil the request. In response, the client lodged a complaint with the Belgian DPA. The Litigation chamber (Geschillenkamer) of the DPA ruled on the 15th of May 2019 that the argument of the Bank concerning the technical impossibility was not sufficient. The Litigation chamber ruled that the Bank should comply with the request of Client Y. The Bank decided to appeal the decision, because - inter alia - it was already working on upgrading their computer systems and the problem should be fixed within several months. In the appeal procedure, the Bank argues that there is no obligation to use correct diacritics in capital letters, and that this is not "personal data". The DPA disagrees and argues that Article 16 GDPR unreservedly grants the right to the data subject to request the rectification of incorrect personal data without delay. Correct spelling of one's name is personal data in accordance with Article 4(1) GDPR, according to the DPA. The Court of Appeal of Brussels held that, in accordance with Article 16 GDPR, the data subject has the right for their name to be correctly spelled when processed by the computer systems of the Bank. To claim in 2019 that adapting a computer system to correctly handle diacritics would cost several months of work and/or constitute additional costs for the Bank, does not allow the Bank to disregard the rights of the data subject. A correctly functioning banking institution may be expected to have computing systems that meet current standards, including the right to correct spelling of people's names.
In 2015, the CNIL informed Google that it must remove links from all versions of its search engine throughout the world when implementing an erasure request from a data subject. Google declined to comply, limiting its de-referencing of links obtained via its search engines with domain extensions inside the EU only (e.g. google.de or google.fr), as well as using geo-blocking techniques, which prohibits links from appearing in searches performed in France regardless of the version used. As a consequence, the CNIL imposed a fine of 100.000 EUR on Google due to non-compliance with the data protection legislation. Google filed a request with the Conseil d'État to have the fine annulled. The Conseil d'État subsequently submitted concerns to the Court of Justice, citing "many severe challenges" surrounding the interpretation of the directive. 'Single act of processing': The search engine in this case must be regarded as carrying out a single act of personal data processing, because of the existence of gateways between its various national versions. Following this reasoning the act of processing is carried out within the framework of an establishment of Google in a Union Member State (France in this case). Territorial scope: The fact that the search engine is operated by a company situated in a 'third state' cannot lead to an exemption of the processing of personal data for the purpose of the operation of that search engine (in connection with the advertising and commercial activities) of an establishment of the controller on the territory of a Member State from the obligations and safeguards of Directive 95/46 and Regulation 2016/679 (GDPR). The Court explained that the Directive and GDPR do not indicate that EU legislature has chosen to establish a scope which would go beyond the territory of the Member States and thus ruled that search engine operators are not required under EU law to remove links on all the versions of its search engine. Ruling: It follows that where
Since 2016, SpaceNet AG, an ISP, has been challenging a German law which provides for an obligation to store traffic and location data of all users without any reason and across the board, arguing it is incompatible with the EU Charter of Fundamental Rights. Question referred "In the light of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12012P/TXT Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union], on the one hand, and of Article 6 of the Charter of Fundamental Rights of the European Union and Article 4 of the Treaty on European Union, on the other hand, is [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN Article 15 of Directive 2002/58/EC] to be interpreted as precluding national legislation which obliges providers of publicly available electronic communications services to retain traffic and location data of end users of those services where * that obligation does not require a specific reason in terms of location, time or region, * the following data are the subject of the storage obligation in the provision of publicly available telephone services — including the transmission of short messages, multimedia messages or similar messages and unanswered or unsuccessful calls: * the telephone number or other identifier of the calling and called parties as well as, in the case of call switching or forwarding, of every other line involved, * the date and time of the start and end of the call or — in the case of the transmission of a short message, multimedia message or similar message — the times of dispatch and receipt of the message, and an indication of the relevant time zone, * information regarding the service used, if different services can be used in the context of the telephone service, * and also, in the case of mobile telephone services the International Mobile Subscriber Identity of the calling and called parties, the international identifier of the calling and c
The Dutch Bar Association published the plaintiff’s name on the online list of suspended and removed lawyers, after a disciplinary measure of unconditional suspension had been imposed on him. The plaintiff asked Google to remove the list from the search results relating to his name. Google refused and indicated the website operator as the competent entity for this removal. The Association, which was the website operator, rejected his request. The Court recalled Article 34 of the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp) which foresees that a written decision on a request submitted under Articles 15 to 22 GDPR shall be regarded as falling within the time limits referred to in Article 12(3) GDPR and, in so far as it has been taken by an administrative body, such as the Bar Association, this decision shall be deemed as a decision within the meaning of the General Administrative Law Act. Therefore, the Association rightly refused to grant the request for erasure under Article 17 GDPR. Moreover, the Court found that the plaintiff did not justify his reliance on Article 18 GDPR. As for Article 21 GDPR, the Court ruled that the public interest in the publication of the list outweighs the plausible interest of the plaintiff to apply for a job unencumbered. Therefore, the Court dismissed the appeal as unfounded.
The applicant does not have a user account on Facebook, nor uses the Facebook Messenger, but she found out that other users shared messages with her friends and family members. She claimed that the messages included untrue allegations about her and she requested to be provided with all the relevant data of the users’ accounts in order to support civil law claims. The German Federal Court of Justice noted, that the German Telemedia Act (TMG) covers the social network service providers, including Facebook Messenger. This Act allows the disclosure of user data by the providers for the enforcement of civil law claims and according to the Court it constitutes a necessary and proportionate measure in a democratic society as required under Article 23(1)(j) GDPR. Moreover, the exception provided for under Article 6(4) GDPR which allows processing for different purposes when it is based on Member State law is not limited to the fulfillment of a “legal obligation” or “public interest” according to Article 6(1)(c) GDPR and Article 6(1)(e) GDPR.
Four applicants wanted to exercise their right to de-referencing concerning various links to third-party websites which contained sensitive data pertaining to them. As the requests were rejected by Google, the applicants brought complaints before the Commission Nationale de l’Informatique et des Libertés (CNIL), the French data protection authority. the CNIL refused, however, to serve formal notice on Google to carry out the de-referencing requested. Thereupon, the applicants turned to the Council of State (Counsel d’État), which ordered a stay of the proceedings and referred to the Court four questions relating to the applicability of the prohibition of the processing of sensitive data in the context of search engines and to the de-referencing of such data. The Court recalled that an activity of a search engine, which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and making it available to internet users according to a particular order of preference, must be classified as "processing of personal data" and that the operator of the search engine therefore needs to be considered a 'controller' within the means of article 4(7) GDPR. In its preliminary ruling the court judged that: * Information relating to legal proceedings brought against an individual and information relating to an ensuing conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46 (and Article 10 GDPR); * The operator of a search engine is in principle required to accede to requests for de-referencing links to web pages containing sensitive personal data, unless an exemption is applicable; * A search engine operator does not need to automatically delete links to specific sites following an erasure request made by the data subject. Instead, in order to determine whether to remove links to pages that contain sensitive personal data, the search eng
A customer and later employee of a bank was put in an Incidents Register, after alleged fraud during certain transaction. The data subject requested from the Bank to delete the personal data kept at the Incidents Register and the External Referral Register ("EVR") and refrain from any further processing. The request was based on Article 46 of the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp), implementing GDPR. The Bank rejected the request, but said the data will be deleted within three years. The District Court of Amsterdam also rejected the customer's application. The customer has appealed. The Court had to assess whether the bank lawfully rejected the customer's request and keep processing his personal data according to the applicable data protection framework. The Court found that that the inclusion of the applicant’s personal data in the EVR was necessary for the compliance with national legal obligation. In addition, retaining the personal data was in line with the principle of proportionality. The court based its decision on the national data protection law prior to the GDPR’s entry into force because the facts at stake took place before May 2018.
Mansfield introduced an obligatory employee fingerprint scanner on cash registers in its stores. One of the employees objected to the use of this technology based on [Article 9 GDPR] and Article 29 of the Dutch GDPR Implementation Act (“UAVG”). The store employee did not agree that the processing of the fingerprint was necessary for the authentication and security purposes. The parties asked the Court to clarify whether the use of fingerprint scanner in this case violated the right to privacy of the store sales assistant. The judge found that a fingerprint constituted indeed personal data (same authorisation system was also used for time registration purposes, which means there was a clear link between the fingerprint and a person) and that Manfield was not allowed to process fingerprints to enhance its security and fraud prevention measures. It also found that Article 29 of the Dutch GDPR Implementation Act was not applicable in this case because Manfield could not demonstrate necessity and proportionality of this processing.